Malicious code in eth-react-provider (npm)

{
  "id": "52240a386a400b3c8185201c052597da38d0a5bf8e9e4cb60ff75ff817855b27",
  "url": "https://osv.dev/vulnerability/MAL-2026-14300",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in eth-react-provider (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387) The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main entry lib/index.js contains web3.js Subscriptions code plus a large obfuscated payload wrapped in a Function(\"ObbvO95\", \"...\") constructor that is invoked at module load. The payload uses randomized hex-named identifiers, a signed-integer decode table, and a doubly-unicode-escaped string body to hide its behavior from static inspection. Any consumer that require('eth-react-provider') executes this opaque code in the installer's process. The src/index.js in the tarball contains the clean web3.js source without this payload, indicating the built artifact was tampered. The README/code mismatch (documented React hook API vs. actual web3.js Subscriptions plus loader) is consistent with a trojanized lookalike package rather than a broken release. ## Source: ghsa-malware (b162f07f49b00538ec535c8fb33f0f6561ec39893acb28e55a8450de8a026322) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package w",
    "evidence": "osv:MAL-2026-14300",
    "products": [
      {
        "name": {
          "value": "eth-react-provider",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-14300",
      "aliases": [
        "GHSA-rr86-r66c-qc54",
        "MAL-2026-14300"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "eth-react-provider",
            "purl": "pkg:npm/eth-react-provider",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eth-react-provider/MAL-2026-14300.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "lib/index.js",
                  "tlsh": "eeb3bac722fa961dcc92cea08df45e4d43a85422cfc510c4bf979d5ee6ae690ebe1344",
                  "sha256": "faaf7c7168b80ef8148c54ed779926fed0edd38bb391f980f5e12981bcbb9683"
                },
                {
                  "path": "README.md",
                  "tlsh": "0ac18438a57923c046630cc7bec76d65db9c306a304c80f966abe270d7d3e998ead5c5",
                  "sha256": "fb64b35dde8d878f96e9278195f9fac32aa9242901a2808d99fd76c4c8ff2ccb"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "fe0aa0870dcfce8d5e8fb920191bc973ee558a88",
                    "sha512_sri": "sha512-EItjOF5tvXI5P6dVh/mfTOG6GKE42M0aYp3DMndl8PaOitbqeaq45cwBHdJ63TdEVoky5Zq0TB3KVIKGAZ1fCg=="
                  },
                  "filename": "eth-react-provider-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-14T22:30:05.270030878Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/eth-react-provider/v/1.0.0",
        "https://github.com/advisories/GHSA-rr86-r66c-qc54"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-018420",
            "sha256": "7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-08-19T10:44:44.683387848Z",
            "modified_time": "2026-08-19T10:14:36Z"
          },
          {
            "id": "GHSA-rr86-r66c-qc54",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "b162f07f49b00538ec535c8fb33f0f6561ec39893acb28e55a8450de8a026322",
            "source": "ghsa-malware",
            "import_time": "2026-10-14T22:23:09.454941486Z",
            "modified_time": "2026-10-14T22:21:13Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 317604,
  "published_at": "2026-08-19T10:14:36+00:00"
}